@evident-ai/cli 3.1.1-dev.3d68bee → 3.1.1-dev.504d05d

package/dist/index.js

@@ -2062,6 +2062,7 @@ var DEFAULT_STUCK_QUEUED_MS = 6e4;
 var HEARTBEAT_MS = 6e4;
 var ABSOLUTE_MAX_PROCESSING_MS = 6 * 60 * 60 * 1e3;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
+var MAX_SUPERSEDED_CONVERSATIONS = 256;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -2100,6 +2101,34 @@ var ChannelDriver = class _ChannelDriver {
   now;
   /** Cache of conversationId → opencode sessionId. */
   sessions = /* @__PURE__ */ new Map();
+  /**
+   * conversationId → the opencode session this runner has ABANDONED as that
+   * conversation's binding (#553), after a genuine (`sessionExists === true`)
+   * dispatch failure: the session still exists but is wedged, so #485's self-heal
+   * must bind a fresh one.
+   *
+   * Dropping the local binding + clearing the server row is not enough on its own:
+   * a SIBLING message dispatched earlier in the same drain is still in-flight under
+   * the same session, and its watcher's routine status writes carry
+   * `opencode_session_id`, RESURRECTING the wedged id server-side after the clear —
+   * and `ensureSession`'s persisted-id fallback then reuses it, defeating the
+   * self-heal. This map makes the runner authoritative instead of racing those
+   * writes: *`ensureSession` never reuses an abandoned id for that conversation,
+   * whatever the server row says* — which holds even when the resurrecting write
+   * is one we deliberately keep (see `markDone`).
+   *
+   * Bounded by construction, on both axes: keyed by CONVERSATION, so N failures on
+   * one conversation hold ONE entry (the newest abandonment replaces the older), and
+   * hard-capped at `MAX_SUPERSEDED_CONVERSATIONS` with FIFO eviction. Only the
+   * NEWEST abandoned id per conversation is guarded: after a second abandonment a
+   * late sibling of the FIRST session can write that id back and `ensureSession`
+   * will reuse it — costing ONE repeat failure, which re-supersedes it. Deliberately
+   * NOT dropped when the session's watcher tears down: `markDone` still writes the
+   * abandoned id back (it must, or the reply is lost), so the guard has to outlive
+   * the turn that resurrects it. In-memory only — a restart forgets it, at the same
+   * bounded cost.
+   */
+  supersededSessions = /* @__PURE__ */ new Map();
   /**
    * Per-opencode-session dispatch lock (Task 2.1a). `sendPromptAsync` is no
    * longer idempotent (no caller-supplied `messageID`), and its read-back picks
@@ -2408,10 +2437,15 @@ var ChannelDriver = class _ChannelDriver {
    * @returns the count of messages NEWLY dispatched (not already in-flight).
    */
   async processConversation(conv) {
-    const sessionId = await this.ensureSession(conv);
+    const { sessionId, refusedSessionId } = await this.ensureSession(conv);
     const messages = await this.getPendingMessages(conv.id);
     let dispatched = 0;
     let skippedAlreadyDispatched = 0;
+    if (refusedSessionId && messages.length > 0) {
+      void this.postSignal(conv.id, messages[0].id, "session_superseded", {
+        superseded_session_id: refusedSessionId
+      });
+    }
     for (const message of messages) {
       if (this.stopped) break;
       if (this.dispatched.has(message.id)) {
@@ -2460,6 +2494,13 @@ var ChannelDriver = class _ChannelDriver {
         }
         const errorMessage = err instanceof Error ? err.message : String(err);
         this.sessions.delete(conv.id);
+        this.supersede(conv.id, sessionId);
+        this.log({
+          level: "warn",
+          message: `Abandoning OpenCode session ${sessionId.slice(0, 8)} as the binding for conversation ${conv.id.slice(0, 8)} (it exists but failed to run a turn) \u2014 a fresh session is created on the next tick, whatever the persisted binding says by then.`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
         await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
           this.log({
             level: "warn",
@@ -2500,8 +2541,42 @@ var ChannelDriver = class _ChannelDriver {
     this.ensureWatcherRunning(sessionId);
     return dispatched;
   }
+  /**
+   * Record that `sessionId` is no longer a valid binding for `conversationId`
+   * (#553). Keyed by conversation and hard-capped, so it cannot grow with the
+   * number of failures — see the `supersededSessions` field doc.
+   */
+  supersede(conversationId, sessionId) {
+    this.supersededSessions.delete(conversationId);
+    this.supersededSessions.set(conversationId, sessionId);
+    while (this.supersededSessions.size > MAX_SUPERSEDED_CONVERSATIONS) {
+      const oldest = this.supersededSessions.keys().next().value;
+      if (oldest === void 0) return;
+      this.supersededSessions.delete(oldest);
+    }
+  }
+  /** Whether `sessionId` is the session this conversation has abandoned (#553). */
+  isSuperseded(conversationId, sessionId) {
+    return this.supersededSessions.get(conversationId) === sessionId;
+  }
+  /**
+   * Resolve the opencode session to run this conversation's turns in.
+   *
+   * `refusedSessionId` is set when the #553 guard fired — i.e. the persisted
+   * binding was an id this runner had abandoned, so a resurrection genuinely
+   * happened and a fresh session was bound instead. The caller reports it.
+   */
   async ensureSession(conv) {
     const bound = this.sessions.get(conv.id) ?? conv.opencode_session_id ?? null;
+    if (bound && this.isSuperseded(conv.id, bound)) {
+      this.log({
+        level: "warn",
+        message: `OpenCode session ${bound.slice(0, 8)} was abandoned for conversation ${conv.id.slice(0, 8)} after a failed dispatch but is still bound to it (the persisted id was written back by a turn already in flight) \u2014 ignoring it and binding a fresh session.`,
+        conversation_id: conv.id
+      });
+      this.sessions.delete(conv.id);
+      return { sessionId: await this.createAndBindSession(conv.id), refusedSessionId: bound };
+    }
     if (bound) {
       const exists = await sessionExists(this.port, bound);
       if (exists === false) {
@@ -2511,12 +2586,12 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id
         });
         this.sessions.delete(conv.id);
-        return this.createAndBindSession(conv.id);
+        return { sessionId: await this.createAndBindSession(conv.id) };
       }
       this.sessions.set(conv.id, bound);
-      return bound;
+      return { sessionId: bound };
     }
-    return this.createAndBindSession(conv.id);
+    return { sessionId: await this.createAndBindSession(conv.id) };
   }
   /**
    * Create a fresh OpenCode session for a conversation, cache the binding, and
@@ -3975,6 +4050,32 @@ var ChannelDriver = class _ChannelDriver {
     }
     return messages;
   }
+  /**
+   * The `opencode_session_id` fragment of a status PATCH body — `{}` when this
+   * conversation has ABANDONED that session (#553). The field is optional
+   * server-side and an absent one leaves the persisted binding untouched, so
+   * omitting it is how a routine status write stops resurrecting it.
+   *
+   * ONLY for writes whose sole cost is a lost deep link. The `processing` notice
+   * degrades to no "View in Evident" link (the reaction swap still fires) and the
+   * turn-failure notice is built from the PATCH's own `error` text with a link off
+   * the persisted row — neither loses content the user came for. `markDone`
+   * deliberately does NOT use this helper: the server fetches the reply text
+   * THROUGH the session id it is given, so suppressing there would replace the
+   * agent's answer with a bare "✅ Done!" (the #183/#187 failure). The
+   * `ensureSession` guard, not this suppression, is what makes the self-heal
+   * stick.
+   */
+  sessionIdBody(sessionId, conversationId, messageId, status) {
+    if (!this.isSuperseded(conversationId, sessionId)) return { opencode_session_id: sessionId };
+    this.log({
+      level: "debug",
+      message: `Omitting the abandoned OpenCode session ${sessionId.slice(0, 8)} from the '${status}' update for message ${messageId.slice(0, 8)} so it is not re-bound to conversation ${conversationId.slice(0, 8)}`,
+      conversation_id: conversationId,
+      message_id: messageId
+    });
+    return {};
+  }
   /**
    * EXISTING combinedAuth route — now fired by the watcher on queued→running
    * (Task 3.3), NOT at dispatch/claim time. `{status:'processing',
@@ -4004,7 +4105,7 @@ var ChannelDriver = class _ChannelDriver {
         headers: { Authorization: this.getAuthHeader(), "Content-Type": "application/json" },
         body: JSON.stringify({
           status: "processing",
-          opencode_session_id: sessionId,
+          ...this.sessionIdBody(sessionId, conversationId, messageId, "processing"),
           ...opencodeMessageId ? { opencode_message_id: opencodeMessageId } : {},
           ...title ? { title } : {}
         })
@@ -4053,6 +4154,11 @@ var ChannelDriver = class _ChannelDriver {
         headers: { Authorization: this.getAuthHeader(), "Content-Type": "application/json" },
         body: JSON.stringify({
           status: "done",
+          // ALWAYS sent, even for a session this conversation has abandoned
+          // (#553): the server reads the reply text back out of THIS session id
+          // to deliver it. Omitting it would leave the user with "✅ Done!"
+          // instead of the answer — a worse regression than the resurrection it
+          // would prevent, which `ensureSession`'s guard handles anyway.
           opencode_session_id: sessionId,
           ...opencodeMessageId ? { opencode_message_id: opencodeMessageId } : {},
           ...title ? { title } : {},
@@ -4081,7 +4187,11 @@ var ChannelDriver = class _ChannelDriver {
    */
   async markFailed(conversationId, messageId, sessionId, error2, usage) {
     const body = { status: "failed" };
-    if (sessionId !== void 0) body.opencode_session_id = sessionId;
+    if (sessionId === null) {
+      body.opencode_session_id = null;
+    } else if (sessionId !== void 0) {
+      Object.assign(body, this.sessionIdBody(sessionId, conversationId, messageId, "failed"));
+    }
     if (error2 !== void 0) body.error = error2;
     if (usage) Object.assign(body, usage);
     await this.callWithRetry(